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5. SUMMARY OF CLAIMED SUBJECT MATTER 

Independent claims 5 and 1 5 of tlie present application are drawn to the 
generation of a virus signature for a scripting virus and its polymorphs that can reliably 
detect the virus and its polymorphs. Independent claim 25 is drawn to a computer 
readable medium containing program code for generating a virus signature for a scripting 
virus and its polymorphs that can reliably detect the virus and its polymorphs. 

Independent claims 1 and 1 1 of the present application are drawn to the detection 
of a scripting virus and its polymorphs. Independent claim 2 1 is drawn to a computer 
readablie medium containing program code for delecting a scripting vims and its 
polymorphs. 

Claims 3 and 4 arc dcpendem on claim 1 and further limit claim 1. 

Following is a mapping of the each of the independent claims (1 , 5, 1 1, 15, 21 and 
25) and each of the dependent claims argued separately (3 and 4) to the specification by 
page and line number and to the drawings by reference characters. 

Claim 1 recites a method for identifying a computer virus in interpreted language 
source code (204 and Fig. 5 A) using a virus scan engine (200). The method (Fig. 4) 
involves receiving (302) a ponion of uiterpreted language soiu-ce code (204 and Fig 5A) 
(page 10, lines 24-26), generating a language-independent representation of the portion of 
the inteipreted language source code (page 11, lines 17-20), comparing (312) the 
language-independent representation with a virus signature in a pattern matcher (218) 
(page 16, lines 30-31 though page 17, line 1), and determining (312) if the language- 
independent representation matches the virus signature, whereby a match indicates a 
computer virus has been identified (page 17, lines 8-12). 
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Claim 3 recites the method of claim 1 with the limitation that the virus signature 
is a language-independent representation of an interpreted language source code 
computer virus (page 4. line 29 though page 5, lines 1-2), 

Claim 4 recites the method of claim 1 with the limiiation that the portion of 
interpreted langiiage source code and the virus signature are represented as a linearized 
string of key actions (page 14, lines 26-28 and page 15, lines 25-26). 

Claim 1 1 recites a method for identifying a virus in interpreted language soiu*ce 
code (204 and Fig. 5A) using a virus scan engine (200). The method (Fig. 4) involves 
receiving (302) a portion of inierpreied language source code (204 and Fig, 5 A) (page 10, 
lines 24-26), parsing (304) the portion of the interpreted language source code (204 and 
Fig, SA) into tokens to generate a tokenized source code (204 and Fig. SB) using a 
parser (206), wherein at least some of the tokens represent key actions (page 11^ lines 1-3 
and lines 8-10), extracting (306) selected key actions from the tokcnized source code 
(204' and Fig, 5B) (page 1 1, lines 17-18), linearizing (306) the key actions to generate an 
executing thread (210 and Fig, 7) (page 11, lines 18-20), comparing (3 12) the executing 
thread (210 and Fig. 7) with a virus signature of a known virus in a pattern matcher (218) 
(page 16, lines 30-31 though page 17, line 1), and detemiining (312) whether the 
executing thread (210 and Fig. 7) matches the virus signature (page 17, lines 8-12). 

Claim 2 1 describes a computer readable medium containing program code for 
identifying a computer virus in interpreted language source code (204 and Fig, 5 A) using 
a virus scan engine. The program code comprises instructions (Fig. 4) for receiving (302) 
a portion of interpreted language source codtj (204 and Fig. 5 A) (page 10, lines 24-26), 
parsing (304) the portion of the interpreted language source code (204 and Fig, 5A) into 
tokens to generate a tokenized source code (204' and Fig. 5B) using a parser (206), 
wherein at least some of the tokens represent key actions (page 11, lines 1-3 and lines 8- 
10), linearizing (306) at least a portion of the key actions to generate an executing thread 
(210 and Fig. 7) (page 1 1, lines 18-20), comparing (312) the executing thread (210 and 
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Fig. 7) with a virus signature of a icnown computer virus in a partem matcher (218) (page 
16, lines 30-3 1 though page 17, line 1 ), and determining (3 12) whether the executing 
thread matches the virus signature (page 17, lines 8-12), 

Claim 5 recites a method for generating a virus signature using a virus scan 
engine (200). The method (Fig. .4) involves receiving (302) a portion of interpreted 
language source code containing a computer virus (204 and Fig, 5 A) (page 14, lines 16- 
18), parsing (304) the portion of interpreted language source code (204 and Fig. 5 A) into 
tokens using a parser (206) (page 14, lines 19-20), inputting (306) at least a portion of 
the tokens into a ihreadizor (208) (page 14, line 23), generating (306) a language- 
independent representation of The computer virus from the portion of the tokens using the 
Threadizor (208), wherein the language independent representation is a linearized string of 
key actions (210 and Fig. 7) (page 14, lines 23-25), and storing (310) the language- 
independent representation of the computer virus as a virus signature (page 16. lines 7-8). 

Claim 1 5 recites a method for generating a virus signature from a portion of 
interpreted language source code including a computer virus (204 and Fig, 5A) using a 
virus scan engine (200). The meihod (Fig, 4) involves receiving (302) a portion of 
interpreted language source code containing a computer virus (204 and Fig. 5A) (page 
14, lines 16-18), parsing (304) ihe portion of tlie inten^reted language source code 
containing the computer virus (204 and Fig. 5 A) into tokens to generate tokenizcd source 
code (204' and Fig. 5B) using a parser (206), wherein at least some of the tokens 
represent key actions (page 14, lines 19-20), extracting key actions from the tokenized 
source code (204' and Fig. 5B) (page 15, lines 12-17), linearizing (306) the key actions to 
gencraie an executing tlii-ead (210 and Fig. 7) using a threadizor (208) (page 1 5, lines 1 8- 
24), determining the set of minimum key actions in the executing thread (210 and Fig, 7) 
required to effect the computer virus (page 12, lines 13-1 5), and storing (310) the set of 
minimum key actions as a virus signature (page 1 6, lines 7-8). 
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C]aim 25 describes a computer readable mediiun containing program code for 
generating a virus signature from a portion of inteipreted Janguage source code including 
a computer virus (204 and Fig. 5A) using a virus scan engine (200). The program code 
comprises instructions (Fig. 4) for receiving (302) a portion of inteq^rcied language 
source code containing a computer virus (204 and Fig. 5A) (page 14, lines 16^18), 
parsing (304) the portion of the interpreted language souree code containing the computer 
virus (204 and Fig. 5A) into tokens to generate lokenized source code (204' and Fig. 5B) 
using a parser (206) . wherein at least some of the tokens represent key actions (page 14. 
lines 1 9-20). linearizing (306) at least a portion of the key actions to generate an 
executing thread (210and Fig. 7) usingathreadizor (208) (page 15. lines 18-24), 
determining the set of minimum key actions in the executing thread (2 10 and Fig'. 7) 
required to effect the computer virus (page 12, lines 13-15), and storing (310) the set of 
minimum key actions as a virus signature (page 16, lines 7-8). 
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